Buffer Overflow Vulnerability in Google Brotli Decoder
CVE-2026-111497

9.2CRITICAL

Key Information:

Vendor: Google
Status: Brotli
Vendor: CVE Published:; 22 October 2026

Badges

🥇 Trended No. 1📈 Trended📈 Score: 218,000💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 82%🦅 CISA Reported📰 News Worthy

What is CVE-2026-111497?

CVE-2026-111497 is a buffer overflow vulnerability found in the Brotli decoder, a component of the Google Brotli compression library, which is commonly used in various applications for efficient data compression. This vulnerability affects Brotli versions 1.0.3 through 1.2.0 across all platforms. An attacker exploiting this vulnerability can craft a specially formatted Brotli-compressed stream to potentially corrupt adjacent memory, leading to a variety of harmful outcomes. This includes the possibility of disclosing sensitive information from memory, causing a denial of service that could disrupt operations, and even executing arbitrary code remotely. Therefore, organizations utilizing affected versions of the Brotli library are at risk of severe security breaches that could impact data integrity and system availability.

Potential impact of CVE-2026-111497

Remote Code Execution: An attacker could exploit this vulnerability to execute arbitrary code on the affected system, leading to significant security breaches and unauthorized control over organizational infrastructure.
Denial of Service: The vulnerability can cause applications that utilize the Brotli decoder to crash or become unresponsive, resulting in a denial of service that impacts business operations and user accessibility.
Data Disclosure: By corrupting adjacent memory states, attackers may gain access to sensitive information stored in memory, potentially leading to data breaches that compromise confidential organizational data and violate compliance mandates.

CISA has reported CVE-2026-111497

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-111497 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Brotli 1.0.3 < 1.0.10

Brotli 1.1.0 < 1.1.1

Brotli 1.2.0 < 1.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

http2shell-CVE-2026-111497
Created by Hika-sec

cve-2026-111497-wordpress-pingback-brotli
Created by fortbridge

node2shell-poc
Created by ZeroHackOrg

News Articles

Dev Community

CVE-2026-111497 CVE-2026-119977

WordPress CVE-2026-119977 and Brotli CVE-2026-111497: Two Exploited Flaws, What to Do Now

Two exploited flaws hit WordPress sites: CVE-2026-119977 lets attackers run code during a core upgrade, and CVE-2026-111497 in the Brotli library reaches WordPress through its HTTP requests. Which versions fix them and how to check a site. Tagged with wordpress, phpsecurity, webapplicationsecurity, ...

2 days ago